fix(kanban): survivor capture cost is per-REMOTE-REF, starving the kanban_complete tool at 420s

[Kyzcreig]

fix(kanban): survivor capture cost is per-REMOTE-REF, starving the complete tool

The kanban_complete TOOL timed out at 420s three times on card t_a49e8a28 and
wrote nothing (task stayed running), while the CLI closed the same card
against the same DB in 1.818s. A worker with no CLI fallback could reach no
terminal state at all.

The card's stated suspect was workspace SIZE (632 MB / 39,738 files). Measured,
that is not the cause: a seeded 39,995-file scratch workspace with one remote
completes via complete_task in 1.52s. The cause is REMOTE REF COUNT. That
workspace had 5 remotes advertising 7,937 heads, and both ref scans in
kanban_survivor spawned a git process PER REF:

_remote_survivor 1 spawn/ref 90.9 ms/ref -> 721s projected
_base 2 spawns/ref 90.5 ms/ref -> 718s projected

Either alone exceeds agent.tool_executor._DEFAULT_CONCURRENT_TOOL_TIMEOUT_S
(420s), which is exactly why the tool died silently and the CLI -- which never
hits that ceiling -- did not. The starvation happens inside preserve(), before
complete_task reaches its write txn, so nothing is ever committed.

Both loops become set-based git rev-list forms:

_remote_survivor "HEAD contained in some ref" == "HEAD has no commit outside
the ref set" -> one rev-list --count
_base the nearest published ancestor is a BOUNDARY commit of
rev-list HEAD ^<every ref> -> one rev-list --boundary

Two things make the bulk form EXACTLY match per-ref rather than approximate it:

• A remote may advertise a sha absent from the local object store (the real
  workspace was missing 1 of 2,917). rev-list ^<unknown> aborts the whole
  walk with "fatal: bad object"; the per-ref loops passed check=False and
  skipped those. So the set is filtered through one cat-file --batch-check
  first (measured 0.025s for 2,917 shas).
• --not --stdin does NOT negate stdin revs (measured: returned 52,090, the
  whole positive union, vs 6 for the explicit ^ form). Each line is written
  pre-negated. Caught by a false-pass in the verification probe.

_base also handles an empty --boundary walk as HEAD ITSELF being the base,
not as "no base": git prints no boundary when HEAD is already published, which
is the per-ref case merge-base == HEAD at distance 0. Reading it as None
downgraded a pushed-but-dirty repo from a patch survivor to a whole-tree
bundle (caught by 5 existing tests).

Verified on the REAL failing workspace (still on disk, 632 MB, 5 remotes,
7,937 heads): _capture now returns in 5.42s having never finished within 420s
before, and picks base a3d0b75 -- identical to
the per-ref ground truth, same distance 6.

Scope, per the card's "check all four": only complete_task reaches this scan
(via preserve). block_task, request_review and request_changes never call it
and were never exposed; a new test pins that so a future change cannot route a
ref scan onto them silently.

Tests gate the COMPLEXITY (git-spawn-count ratio), not wall clock, so they
cannot flake on a loaded runner. Mutation-checked both loops independently:
restoring the per-ref _remote_survivor -> 15 spawns at 4 refs vs 51 at 40
(RED); restoring per-ref _base -> 18 vs 90 (RED); fix -> flat (GREEN).

Regression guard included: completion must still record the survivor row with
held_reason NULL, so this cannot be "fixed" by skipping capture.

Suite: 173 survivor tests pass (same as the clean fork/main baseline measured
in a separate worktree) + 8 new = 181. The 16 failures in
tests/tools/test_kanban_tools.py and test_kanban_review_surfaces.py are
INHERITED -- identical on clean fork/main at f8b6d54, untouched by this diff.

Fork-only: hermes_cli/kanban_survivor.py does not exist in NousResearch/main
(no survivor layer upstream at all), so there is nothing to upstream.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[Kyzcreig]

🤖 merged-by: apollo · lane: landing-stack · gate: BYPASS: FleetReview is DISABLED by operator (Ace: systemctl disable --now fleetreview-router 09:30 PT; 'Fleet reviews currently paused'), so no FR record can exist for any head. Landing on kanban APPROVAL (Argus, EXECUTION lens, measured base) + fully green CI + Apollo pre-flight (no open review runs). Ace 18:17 PT: 'regarding the landing stack, 888 and 891, can we just handle that right now'. · why: t_cbeb632f APPROVED r2 EXECUTION lens (Argus checked out + ran everything; case (c) measured O(log N) on the live 632MB / 9,559-ref workspace). kanban_complete TOOL timed out at 420s from a per-ref git loop (2.000 spawns/ref x 7,937 heads); CLI closed the same card in 1.5s. CI 38/0 CLEAN. Foundation of the survivor stack; #889 and #891 land behind it.

[Kyzcreig]

🤖 merged-by: apollo · lane: fr-pause-0922 · gate: BYPASS: FR PAUSED by Ace ruling 2026-09-22 (state/fleetreview-pause-20260922.md); t_cbeb632f approved · why: argus APPROVED r2 EXECUTION (survivor capture cost per-remote); CI green; Apollo merge pass 2026-09-22